X2Go Bug report logs - #334
Don't allow users to override X2Go commands via ~/bin (or similar)

Full log

Message #19 received at 334@bugs.x2go.org (full text, mbox, reply):

Received: (at 334) by bugs.x2go.org; 16 Jun 2014 06:35:37 +0000
From x2go@ymir.das-netzwerkteam.de  Mon Jun 16 08:35:21 2014
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on
	ymir.das-netzwerkteam.de
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,NO_RELAYS,
	URIBL_BLOCKED autolearn=unavailable version=3.3.2
Received: by ymir.das-netzwerkteam.de (Postfix, from userid 1005)
	id 456B05DB2C; Mon, 16 Jun 2014 08:35:21 +0200 (CEST)
From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
To: 334-submitter@bugs.x2go.org
Cc: control@bugs.x2go.org, 334@bugs.x2go.org
Subject: X2Go issue (in src:python-x2go) has been marked as pending for release
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
X-Mailer: http://snipr.com/post-receive-tag-pending
Message-Id: <20140616063521.456B05DB2C@ymir.das-netzwerkteam.de>
Date: Mon, 16 Jun 2014 08:35:21 +0200 (CEST)

tag #334 pending
fixed #334 0.5.0.0
thanks

Hello,

X2Go issue #334 (src:python-x2go) reported by you has been
fixed in X2Go Git. You can see the changelog below, and you can
check the diff of the fix at:

    http://code.x2go.org/gitweb?p=python-x2go.git;a=commitdiff;h=754bf16

The issue will most likely be fixed in src:python-x2go (0.5.0.0).

light+love
X2Go Git Admin (on behalf of the sender of this mail)

---
commit 754bf16bb2d9f380da16963fd6eb4866cfbfd875
Author: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
Date:   Mon Jun 16 08:34:16 2014 +0200

    Disallow server-side users to override X2Go Server commands via ~/bin (or similar). (Fixes: #334).

diff --git a/debian/changelog b/debian/changelog
index 00f6ec1..67943f0 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -58,6 +58,8 @@ python-x2go (0.5.0.0-0x2go1) UNRELEASED; urgency=low
       instance (happens with polyinstantiated /tmp dirs).
     - Don't start telekinesis client if not support server-side. Don't attempt
       at starting telekinesis client, if it is not installed.
+    - Disallow server-side users to override X2Go Server commands via
+      ~/bin (or similar). (Fixes: #334).
   * debian/control:
     + Add dependencies: python-requests, python-simplejson.
   * python-x2go.spec:

Send a report that this bug log contains spam.